Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7770394

Browse files
serhiy-storchakaserhiy-storchaka
authored
bpo-30746: Prohibited the '=' character in environment variable names (#2382)
in `os.putenv()` and `os.spawn*()`.
1 parent 1ba9469 commit 7770394

4 files changed

Lines changed: 95 additions & 4 deletions

File tree

‎Lib/test/test_os.py‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2382,6 +2382,55 @@ def test_spawnve_noargs(self):
23822382
self.assertRaises(ValueError, os.spawnve, os.P_NOWAIT, args[0], ('',), {})
23832383
self.assertRaises(ValueError, os.spawnve, os.P_NOWAIT, args[0], [''], {})
23842384

2385+
@requires_os_func('spawnve')
2386+
def test_spawnve_invalid_env(self):
2387+
# null character in the enviroment variable name
2388+
args = [sys.executable, '-c', 'pass']
2389+
newenv = os.environ.copy()
2390+
newenv["FRUIT\0VEGETABLE"] = "cabbage"
2391+
try:
2392+
exitcode = os.spawnve(os.P_WAIT, args[0], args, newenv)
2393+
except ValueError:
2394+
pass
2395+
else:
2396+
self.assertEqual(exitcode, 127)
2397+
2398+
# null character in the enviroment variable value
2399+
args = [sys.executable, '-c', 'pass']
2400+
newenv = os.environ.copy()
2401+
newenv["FRUIT"] = "orange\0VEGETABLE=cabbage"
2402+
try:
2403+
exitcode = os.spawnve(os.P_WAIT, args[0], args, newenv)
2404+
except ValueError:
2405+
pass
2406+
else:
2407+
self.assertEqual(exitcode, 127)
2408+
2409+
# equal character in the enviroment variable name
2410+
args = [sys.executable, '-c', 'pass']
2411+
newenv = os.environ.copy()
2412+
newenv["FRUIT=ORANGE"] = "lemon"
2413+
try:
2414+
exitcode = os.spawnve(os.P_WAIT, args[0], args, newenv)
2415+
except ValueError:
2416+
pass
2417+
else:
2418+
self.assertEqual(exitcode, 127)
2419+
2420+
# equal character in the enviroment variable value
2421+
filename = support.TESTFN
2422+
self.addCleanup(support.unlink, filename)
2423+
with open(filename, "w") as fp:
2424+
fp.write('import sys, os\n'
2425+
'if os.getenv("FRUIT") != "orange=lemon":\n'
2426+
' raise AssertionError')
2427+
args = [sys.executable, filename]
2428+
newenv = os.environ.copy()
2429+
newenv["FRUIT"] = "orange=lemon"
2430+
exitcode = os.spawnve(os.P_WAIT, args[0], args, newenv)
2431+
self.assertEqual(exitcode, 0)
2432+
2433+
23852434
# The introduction of this TestCase caused at least two different errors on
23862435
# *nix buildbots. Temporarily skip this to let the buildbots move along.
23872436
@unittest.skip("Skip due to platform/environment differences on *NIX buildbots")

‎Lib/test/test_posix.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -813,6 +813,21 @@ def test_environ(self):
813813
self.assertEqual(type(k), item_type)
814814
self.assertEqual(type(v), item_type)
815815

816+
@unittest.skipUnless(hasattr(os, "putenv"), "requires os.putenv()")
817+
def test_putenv(self):
818+
with self.assertRaises(ValueError):
819+
os.putenv('FRUIT\0VEGETABLE', 'cabbage')
820+
with self.assertRaises(ValueError):
821+
os.putenv(b'FRUIT\0VEGETABLE', b'cabbage')
822+
with self.assertRaises(ValueError):
823+
os.putenv('FRUIT', 'orange\0VEGETABLE=cabbage')
824+
with self.assertRaises(ValueError):
825+
os.putenv(b'FRUIT', b'orange\0VEGETABLE=cabbage')
826+
with self.assertRaises(ValueError):
827+
os.putenv('FRUIT=ORANGE', 'lemon')
828+
with self.assertRaises(ValueError):
829+
os.putenv(b'FRUIT=ORANGE', b'lemon')
830+
816831
@unittest.skipUnless(hasattr(posix, 'getcwd'), 'test needs posix.getcwd()')
817832
def test_getcwd_long_pathnames(self):
818833
dirname = 'getcwd-test-directory-0123456789abcdef-01234567890abcdef'

‎Misc/NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,9 @@ Extension Modules
374374
Library
375375
-------
376376

377+
- bpo-30746: Prohibited the '=' character in environment variable names in
378+
``os.putenv()`` and ``os.spawn*()``.
379+
377380
- bpo-30664: The description of a unittest subtest now preserves the order of
378381
keyword arguments of TestCase.subTest().
379382

‎Modules/posixmodule.c‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4894,6 +4894,14 @@ parse_envlist(PyObject* env, Py_ssize_t *envc_ptr)
48944894
Py_DECREF(key2);
48954895
goto error;
48964896
}
4897+
/* Search from index 1 because on Windows starting '=' is allowed for
4898+
defining hidden environment variables. */
4899+
if (PyUnicode_GET_LENGTH(key2) == 0 ||
4900+
PyUnicode_FindChar(key2, '=', 1, PyUnicode_GET_LENGTH(key2), 1) != -1)
4901+
{
4902+
PyErr_SetString(PyExc_ValueError, "illegal environment variable name");
4903+
goto error;
4904+
}
48974905
keyval = PyUnicode_FromFormat("%U=%U", key2, val2);
48984906
#else
48994907
if (!PyUnicode_FSConverter(key, &key2))
@@ -4902,6 +4910,12 @@ parse_envlist(PyObject* env, Py_ssize_t *envc_ptr)
49024910
Py_DECREF(key2);
49034911
goto error;
49044912
}
4913+
if (PyBytes_GET_SIZE(key2) == 0 ||
4914+
strchr(PyBytes_AS_STRING(key2) + 1, '=') != NULL)
4915+
{
4916+
PyErr_SetString(PyExc_ValueError, "illegal environment variable name");
4917+
goto error;
4918+
}
49054919
keyval = PyBytes_FromFormat("%s=%s", PyBytes_AS_STRING(key2),
49064920
PyBytes_AS_STRING(val2));
49074921
#endif
@@ -8985,9 +8999,16 @@ os_putenv_impl(PyObject *module, PyObject *name, PyObject *value)
89858999
{
89869000
const wchar_t *env;
89879001

9002+
/* Search from index 1 because on Windows starting '=' is allowed for
9003+
defining hidden environment variables. */
9004+
if (PyUnicode_GET_LENGTH(name) == 0 ||
9005+
PyUnicode_FindChar(name, '=', 1, PyUnicode_GET_LENGTH(name), 1) != -1)
9006+
{
9007+
PyErr_SetString(PyExc_ValueError, "illegal environment variable name");
9008+
return NULL;
9009+
}
89889010
PyObject *unicode = PyUnicode_FromFormat("%U=%U", name, value);
89899011
if (unicode == NULL) {
8990-
PyErr_NoMemory();
89919012
return NULL;
89929013
}
89939014
if (_MAX_ENV < PyUnicode_GET_LENGTH(unicode)) {
@@ -9029,12 +9050,15 @@ os_putenv_impl(PyObject *module, PyObject *name, PyObject *value)
90299050
{
90309051
PyObject *bytes = NULL;
90319052
char *env;
9032-
const char *name_string = PyBytes_AsString(name);
9033-
const char *value_string = PyBytes_AsString(value);
9053+
const char *name_string = PyBytes_AS_STRING(name);
9054+
const char *value_string = PyBytes_AS_STRING(value);
90349055

9056+
if (strchr(name_string, '=') != NULL) {
9057+
PyErr_SetString(PyExc_ValueError, "illegal environment variable name");
9058+
return NULL;
9059+
}
90359060
bytes = PyBytes_FromFormat("%s=%s", name_string, value_string);
90369061
if (bytes == NULL) {
9037-
PyErr_NoMemory();
90389062
return NULL;
90399063
}
90409064

0 commit comments

Comments
 (0)